The following provisions apply for the use of AIDS and HIV notifiable conditions case reports and data:

(1) Department personnel must not disclose identifying information received as a result of receiving information regarding a notifiable conditions report of a case of AIDS or HIV unless:

(a) Explicitly and specifically required to do so by state or federal law; or

(b) Authorized by written patient consent.

(2) Department personnel are authorized to use HIV identifying information received as a result of receiving information regarding a notifiable conditions report of a case of AIDS or HIV only for the following purposes:

(a) Notification of persons with substantial exposure, including sexual or syringe-sharing partners;

(b) Referral of the infected individual to social and health services; and

(c) Linkage to other public health databases, provided that the identity or identifying information on the HIV-infected person is not disclosed outside of the health department.

(3) For the purposes of this chapter, public health databases do not include health professions licensing records, certifications or registries, teacher certification lists, other employment rolls or registries, or databases maintained by law enforcement officials.

(4) The state health officer must require and maintain signed confidentiality agreements with all department employees with access to HIV identifying information. These agreements will be renewed at least annually and include reference to criminal and civil penalties for violation of chapter 70.24 RCW and other administrative actions that may be taken by the department.

(5) The state health officer must investigate potential breaches of the confidentiality of HIV identifying information by department employees. All breaches of confidentiality shall be reported to the state health officer or their authorized representative for review and appropriate action.

(6) The department must maintain all HIV case reports in a name-based surveillance system solely for the purpose of complying with HIV reporting guidelines from the federal Centers for Disease Control and Prevention, and must not disclose or otherwise use any information contained in that system for any other purpose, except as expressly permitted by this section.

(7) Authorized representatives of the department must review available records to reascertain the identities of previously reported cases of asymptomatic HIV infection and retain those cases in a confidential name-based system.

(8) The department must maintain HIV case reports in secure systems that meet the following standards and are consistent with the 2006 Security and Confidentiality Guidelines developed by the Centers for Disease Control and Prevention:

(a) Secure systems must be described in written policies that are reviewed annually by the overall responsible party;

(b) Access to case report information must be limited to health department staff who need it to perform their job duties and a current list of these staff must be maintained by the overall responsible party;

(c) All physical locations containing electronic or paper copies of surveillance data must be enclosed in a locked, secured area with limited access and not accessible by window;

(d) Paper copies or electronic media containing surveillance information must be housed inside locked file cabinets that are in the locked, secured area;

(e) A crosscut shredder must be available for destroying information and electronic media must be appropriately sanitized prior to disposal;

(f) Files or databases containing confidential information must reside on either stand-alone computers with restricted access or on networked drives with proper access controls, encryption software and firewall protection;

(g) Electronic communication of confidential information must be protected by encryption standards that are reviewed annually by the overall responsible party;

(h) Locking briefcases must be available for transporting confidential information.

(9) The state health officer or designee must conduct a biennial review of system security measures described in WAC 246-101-520 (1)(b) at local health jurisdictions that are maintaining records by name.

(10) When providing technical assistance to a local health department, authorized representatives of the department may temporarily and subject to the time limitations in WAC 246-101-520 receive the names of reportable cases of HIV infection for the purpose of partner notification, or special studies. Upon completion of the activities by representatives of the state health department, named information will be provided to the local health department subject to the provisions of WAC 246-101-520.

(11) By December 2007, the state health officer, in cooperation with local health officers, will report to the board on:

(a) The ability of the HIV reporting system to meet surveillance performance standards established by the federal Centers for Disease Control and Prevention;

(b) The cost of the reporting system for state and local health departments;

(c) The reporting system's effect on disease control activities;

(d) The impact of HIV reporting on HIV testing among persons at increased risk of HIV infection; and

(e) The availability of anonymous HIV testing in the state.

(12) The state health officer must provide a report to the state board of health if federal policy no longer requires that HIV surveillance systems be name-based.

The following provisions apply to the use of AIDS and HIV notifiable conditions case reports, laboratory reports, and investigation reports, related information, and data and is in addition to the requirements established under WAC 246-101-610:

(1) Department personnel shall not disclose health care information related to a case of AIDS or HIV unless:

(a) Explicitly and specifically required to do so by state or federal law;

(b) Permitted under RCW 70.02.220; or

(c) Authorized by written patient consent.

(2) Department personnel may use HIV identifying information related to a case of AIDS or HIV only for the following purposes:

(a) Notification of persons identified as sex or injection equipment-sharing partners;

(b) Referral of the individual tested, diagnosed, or reported with HIV to social and medical services; and

(c) Linkage to other public health databases, provided that the identity or identifying information of the individual tested, diagnosed, or reported with HIV is not disclosed outside the department.

(3) The state health officer shall require and maintain signed confidentiality agreements with all department employees with access to HIV identifying information. The state health officer shall ensure these agreements are renewed at least annually and include reference to penalties for violation of chapter 70.24 RCW and administrative actions that may be taken by the department.

(4) The state health officer shall investigate potential breaches of the confidentiality of HIV identifying information by department employees. All breaches of confidentiality shall be reported to the state health officer or their authorized representative for review and appropriate action.

(5) The department shall maintain all HIV case reports, laboratory reports, and investigation reports and other data and supporting information in a name-based surveillance system solely for the purpose of complying with HIV reporting guidelines from the Centers for Disease Control and Prevention, and shall not disclose or otherwise use any information contained in that system for any other purpose, except as expressly permitted by this section.

(6) The department shall:

(a) Maintain HIV case reports, laboratory reports, and investigation reports and other data and supporting information in secure systems that meet the following standards and are consistent with the 2011 DataSecurity and Confidentiality Guidelinesfor HIV, Viral Hepatitis, Sexually Transmitted Disease, and Tuberculosis Programs: Standards to Facilitate Sharing and Use of Surveillance Data for Public Health Action published by the Centers for Disease Control and Prevention;

(b) Describe secure systems in written policies and review the policies annually;

(c) Limit access to case report, laboratory report, and investigation report and other data and supporting information to department staff who need it to perform their job duties;

(d) Maintain a current list of department staff with access to case report, laboratory report, and investigation report and other data and supporting information;

(e) Enclose all physical locations containing electronic or paper copies of surveillance data in a locked, secured area with limited access and not accessible by window;

(f) Store paper copies or electronic media containing surveillance information inside locked file cabinets that are in the locked, secured area;

(g) Destroy information by either shredding it with a crosscut shredder or appropriately sanitizing electronic media prior to disposal;

(h) Store files or databases containing confidential information on either stand-alone computers with restricted access or on networked drives with proper access controls, encryption software, and firewall protection;

(i) Protect electronic communication of confidential information by encryption standards and review the standards annually;

(j) Use locking briefcases for transporting confidential information.

(7) The state health officer shall conduct a biennial review of local health jurisdictions system security measures described in WAC 246-101-520 that are maintaining records by name.

(8) When providing technical assistance to a local health jurisdiction, authorized representatives of the department may temporarily, and subject to the time limitations in WAC 246-101-520, receive the names of reportable cases of HIV infection for the purpose of partner notification, or special studies. Upon completion of the activities by representatives of the department, named information will be provided to the local health jurisdiction subject to the provisions of WAC 246-101-520.

(9) The state health officer shall provide a report to the state board of health if federal policy no longer requires that HIV surveillance systems be name-based.